Picture

Yogesh Khatri @SwiftForensics

DFIR R&D guy swiftforensics.com Sydney, Australia Joined June 2011
  • Tweets
    551
  • Followers
    2K
  • Following
    124
  • Likes
    711
Yogesh Khatri retweeted
williballenthin Profile Picture

Willi Ballenthin @williballenthin

a week ago

QUANTUMSTRAND beta 1 released: built for analysts to quickly understand *where* strings are, *what* they might be, and *how* important they are, without getting lost in a sea of undifferentiated text. Thanks @m_r_tz and the crew at @Mandiant FLARE github.com/mandiant/flare…

Yogesh Khatri retweeted
unkn0wnbit Profile Picture

Minoru Kobayashi @unkn0wnbit

3 weeks ago

🛠️ FJTA update released (2025-08-18)! Changes include: ✅ No longer requires TSK 4.13.0 for XFS recognition ✅ Minor code refactoring 🔗 github.com/mnrkbys/fjta #DFIR #Linux

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

4 weeks ago

mac_apt v1.26.1 is here, now supports processing Velociraptor collections and compiled versions for macOS too. Many incremental updates and new plugins (we are at 52 plugins now!). github.com/ydkhatri/mac_a… #DFIR #macOS

Yogesh Khatri retweeted
unkn0wnbit Profile Picture

Minoru Kobayashi @unkn0wnbit

a month ago

🛠️ FJTA update released (2025-07-29)! Changes include: ✅ Improved parsing of XFS journal log records ✅ Enhanced handling of directory entries (ext4/XFS) ✅ Minor bug fixes 🔗 github.com/mnrkbys/fjta #DFIR #Linux

Yogesh Khatri retweeted
PhorionTech Profile Picture

Phorion @PhorionTech

3 months ago

Introducing Phorion. A modern EDR platform purpose-built for macOS. Because security teams shouldn’t have to settle for Windows-first tools. 🛡️🍎 🧵

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

6 months ago

Found an interesting location storing wifi connect/disconnect information on #macos #DFIR swiftforensics.com/2025/01/new-wi…

Yogesh Khatri retweeted
unkn0wnbit Profile Picture

Minoru Kobayashi @unkn0wnbit

7 months ago

Hi, #DFIR guys, I am developing a new forensic tool for parsing journal data of #Linux filesystems (not systemd journal logs). It can not only parse filesystem journals but also generate timeline events for DFIR. This tool currently supports only EXT4, but I plan to add support…

Yogesh Khatri retweeted
bmmaloney97 Profile Picture

Brian Maloney @bmmaloney97

7 months ago

There seemed to be enough interest so I decided to do a write up on what I have found about OneDrive Offline Mode. Hate to burn a forensic artifact but I’m concerned about what Microsoft feels is secure. #DFIR malwaremaloney.blogspot.com/2025/01/onedri…

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

8 months ago

My NTFS journal rewind script explained in this 13Cubed episode. Thanks @davisrichardg .

13CubedDFIR Profile Picture

13Cubed @13CubedDFIR

8 months ago

My NTFS journal rewind script explained in this 13Cubed episode. Thanks @davisrichardg .

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

a year ago

If you've had this problem (see pic), NTFS Journal REWIND solves it! . New blog post + code. No more unknown paths. cybercx.com.au/blog/ntfs-usnj… #NTFS #DFIR

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

2 years ago

Windows Thumbnail caches are a mostly unused artifact. Did you know they can point to paths on external systems? (Yes path embedded in thumbcache file, not from win search db) Can be helpful when threat actors actively delete logs and other artifacts! #DFIR

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

2 years ago

🆕 mac_apt release v1.5.8 New modules, macOS 13 & RSR support, Python 3.10 compatibility, easier installation, bug fixes github.com/ydkhatri/mac_a… #DFIR #macOS

Yogesh Khatri retweeted
binaryz0ne Profile Picture

Ali Hadi | B!n@ry @binaryz0ne

2 years ago

Hey #DFIR & #Malware community. A memory forensics case were you are required to analyze a memory dump of a Windows 10 system that has been hit with a #Ransomware. Let the games begin. Please share! $100 bounty will be paid to whoever solves this case! ashemery.com/dfir.html#Memo…

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

2 years ago

Thanks for merging it @MarkBaggett. Excel output now has autowidth adjustment and auto filter applied, with frozen top row for easy analysis.

MarkBaggett Profile Picture

Mark Baggett @MarkBaggett

2 years ago

Thanks for merging it @MarkBaggett. Excel output now has autowidth adjustment and auto filter applied, with frozen top row for easy analysis.

Yogesh Khatri retweeted
objective_see Profile Picture

Objective-See Foundation @objective_see

3 years ago

🛠️ Just released a new open-source utility: "DumpBTM" It can dump the persistence records of installed items (including persistent malware!) from macOS's proprietary BackgroundItems-v4.btm file. Read more: patreon.com/posts/77420730

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

3 years ago

ODL parser now updated to unobfuscate encrypted strings. MS had changed the format.. Short blog post sharing the details: swiftforensics.com/2022/11/readin… #DFIR

Yogesh Khatri retweeted
1ZRR4H Profile Picture

Germán Fernández @1ZRR4H

3 years ago

📌 Drivers abused by #Ransomware TA to kill AV/EDR's ▪ gdrv.sys (Gigabyte) > #RobinHood 9ab9f3b75a2eb87fafb1b7361be9dfb3 ▪ aswArPot.sys (Avast) > #CUBA and #AvosLocker a179c4093d05a3e1ee73f6ff07f994aa ▪ mhyprot2.sys (Genshin Impact) > #Rever 4b817d0e7714b9d43db43ae4a22a161e

Yogesh Khatri retweeted
blschatz Profile Picture

Bradley Schatz @blschatz

3 years ago

The DFRWS APAC conference is happening *in-person* in Adelaide, Australia Sept 28-30, with the program virtual-friendly. Do join us for the second of what we aim to become a regular forum for the Asia-Pacific #DFIR practitioner and researcher community to connect.

DFRWS Profile Picture

DFRWS @DFRWS

3 years ago

The DFRWS APAC conference is happening *in-person* in Adelaide, Australia Sept 28-30, with the program virtual-friendly. Do join us for the second of what we aim to become a regular forum for the Asia-Pacific #DFIR practitioner and researcher community to connect.

Yogesh Khatri retweeted
bmmaloney97 Profile Picture

Brian Maloney @bmmaloney97

3 years ago

In OneDrive, when a file is deleted that is not on the local filesystem, it is moved to the cloud recycle bin. This can be problematic during endpoint investigations. By incorporating ODL logs, we can find this data. Did Fred Rogers delete more that we were lead to believe? #DFIR

SwiftForensics Profile Picture

Yogesh Khatri @SwiftForensics

4 years ago

So the first part of the blog post on OneDrive Logs (ODL) is finally posted, and so is the python script to parse it! 👇 swiftforensics.com/2022/02/readin… and github.com/ydkhatri/OneDr…

Trends for United States

Chiefs
180 B posts
Herbert
45,1 B posts
Mahomes
60,3 B posts
#SmackDown
166 B posts
AJ Lee
193 B posts
Kelce
38,3 B posts
#KCvsLAC
6.868 posts
Karen
63,6 B posts
Worthy
53,5 B posts
Rich Eisen
4.470 posts
Keenan Allen
4.748 posts
#BoltUp
6.019 posts
Quentin Johnston
5.026 posts
Brazil
129 B posts
Chris Jones
4.346 posts
Karol G
35,9 B posts
Jawaan Taylor
2.394 posts
Madison Beer
2.851 posts
Butker
8.792 posts
Spags
2.342 posts

You might like

KAPE, EZTools, forensics, X-Ways. Certified SANS instructor. FFL Please consider supporting me: https://t.co/pIjxED3CMx
Eric Zimmerman
@EricRZimmerman
19K Followers
Forensically boot evidence machines with a Windows Forensics Operating System! Now boots into ARM devices. #DFIR
Windows Forensic Envi...
@WindowsFE
5K Followers
The Digital Forensics Research Conference is dedicated to the sharing of knowledge and ideas about digital forensics research.
DFRWS
@DFRWS
5K Followers
This Week in 4n6 // ThinkDFIR // SANS // CyberCX (DFIR) https://t.co/vLyL2sxTuy I might not know much, but I do know how to Google Tweets are mine
Phill Moore
@phillmoore
9K Followers
Digital Forensics and Incident Response Professional, SANS Instructor, Maker and VR Gamer
Mari Degrazia
@maridegrazia
8K Followers
Apple 4N6 Nerd, Head of DFIR @IsMyPhoneHacked, Author/Instructor @sansforensics FOR518 Mac/iOS DFIR. Opinions are mine. RT ≠ Endorse
Sarah Edwards 👩�...
@iamevltwin
20K Followers
The official Twitter account for 13Cubed. Follow @davisrichardg for my personal account.
13Cubed
@13CubedDFIR
7K Followers
The official DFIR Training account and most complete #DFIR online resource. Managed by @Brett_Shavers.
DFIR Training
@DFIRTraining
17K Followers
DFIR @cellebrite, Faculty Fellow & author @sansforensics #FOR585 #FOR500, wife, mama, researcher, USAF. Trust but validate. Thoughts are mine.
Heather Mahalik Barnh...
@HeatherMahalik
23K Followers
There is no better reference for X-Ways Forensics practitioners than this guide. #DFIR #xwaysforensics
X-Ways Forensics Prac...
@XWaysGuide
5K Followers
Husband, Father, #DFIR @ Unit 42, Digital Forensics Discord Admin, AboutDFIR Contributor, Author, #USMC Veteran, Former LE, NHL Fan, Dark Mode, Animals, Music
Andrew Rathbun
@bunsofwrath12
3K Followers
Developers of digital forensics weapons which include Arsenal Image Mounter, Hibernation Recon, LevelDB Recon, HBIN Recon, & Registry Recon. Arm Yourself! #DFIR
Arsenal Recon
@ArsenalRecon
3K Followers
#DFIR & #DFIRFit geek, SANS Author/Instructor #FOR308, Instructor #FOR500. All opinions mine.
Kathryn Hedley
@4enzikat0r
3K Followers
Forensicator, Retired Army Warrant Officer, Ret Law Enforcement, RAM Forensics Enthusiast, Artifact first forensics!!! Above all family man.
Jamey Tubbs
@jameytubbs
1K Followers
DFIR Investigator @Microsoft and part-time YouTuber. Follow @13CubedDFIR for 13Cubed updates.
Richard Davis
@davisrichardg
3K Followers